Spill Privacy Policy
Last updated: October 27, 2026
Spill is operated by Prizm. This policy covers the Spill iPhone app, its message-sending webpage, and related services. Contact us at prizm_kr@hotmail.com.
1. Information we process
- Account and session: a public username, an anonymous authentication identifier, session credentials, and account timestamps. Creating an account does not require an email address, phone number, or social login. A username or message may contain personal information if you choose to include it.
- Messages: the message text, recipient identifier, submission time, and delivery request identifiers. Messages can contain up to 200 characters. Senders do not need an account.
- Sender and request information: the sender's IP address, browser/device information, approximate IP-derived location, network or internet provider, and available referral information. We use these for message delivery, sender hints, blocking, and abuse prevention. We do not request GPS location.
- Notifications: a device push token when notifications are enabled, notification delivery information, and the message identifier used to open the right screen. The current notification payload contains a generic new-message notice rather than the message text.
- Usage events: first/app opens, link sharing and visits, message submissions and views, reply-card actions, paywall views, purchase/restore outcomes, and related technical properties. These first-party events are stored in Supabase. Their event properties do not include message text or raw sender IP addresses.
- Purchases: Apple transaction information, purchase history and entitlement status, and RevenueCat's app-scoped customer identifier and related technical information. We do not receive your full payment-card details.
- Support: information you choose to send us, including your email address, username, or purchase reference.
2. How the information is used
We use this information to create sessions, route and display messages, prepare reply cards, send optional notifications, restore purchases, provide visit/message statistics, prevent duplicate delivery, process reports and blocks, maintain the service, and respond to support requests.
Device-type hints are free. Creator PRO adds other available hints, including approximate location, network, and referral source. These signals may be missing or inaccurate and do not establish a sender's identity. The app does not display raw IP addresses as sender hints. Anonymous messaging does not prevent someone from identifying themselves in their own message.
We do not sell personal data or use message contents for advertising. We do collect the first-party usage events described above; this is different from advertising or cross-app tracking.
3. Service providers
| Provider | Purpose and information processed |
|---|---|
| Supabase | Authentication, database, server functions, product statistics, and operational records. Processes account, message, sender, and usage information. |
| Vercel | Hosts the message-sending webpage and processes the network and technical request information needed to serve it. |
| GitHub Pages | Hosts these legal documents and processes the network and request information needed to serve them. |
| RevenueCat and Apple | Process and validate purchases and restorations. Apple handles billing; RevenueCat manages purchase entitlements. |
| Expo Push Service and Apple Push Notification service | Route notifications using push tokens and notification payloads. |
| ip-api.com | Receives a sender IP address to provide approximate location and internet-provider information for hints. |
These providers process information needed for their services. Our current Supabase database is hosted in Mumbai, India. Providers may process information in other countries in accordance with their own terms and privacy policies.
4. Local storage and permissions
The app stores session credentials, a cached profile, messages, read/deletion state, reply drafts, theme preferences, and purchase entitlement information on your device. Cached messages can remain available after their server copy expires. Reply drafts are saved locally while you edit them.
Notifications are optional and can be changed in iOS Settings. The copy action writes your Spill link to the clipboard; it does not read your clipboard contents. Exported cards use the system sharing controls. Spill does not request access to your contacts, microphone, camera, or precise device location to provide these features.
5. Retention and deletion
- Server messages and their attached sender metadata: a daily scheduled task deletes messages older than 30 days. You can delete messages sooner in the app. Operational interruptions can delay scheduled cleanup.
- Local messages and drafts: stored on your device until removed through the relevant app controls or by removing the app's local data. Deleting a server copy does not automatically erase a previously cached local copy.
- Accounts and block lists: retained while the account exists, subject to verified deletion requests. Deleting or uninstalling the app does not automatically delete the server-side account.
- Reports: used for safety review and linked to the reported message and account. The current database removes associated report rows when the relevant message or account is deleted.
- Duplicate-prevention receipts: request identifiers and content fingerprints are kept until account deletion, including after a message is deleted, so a delayed retry cannot recreate it. These receipts do not keep a second copy of the message text.
- Notification jobs: completed, failed, or no-token jobs are routinely removed after 7 days; uncertain delivery outcomes are kept for review for up to 30 days. Message/account deletion can remove them earlier.
- Usage events: retained to provide statistics and operate the product, subject to verified deletion requests and any applicable retention requirements. Message deletion does not automatically delete its associated usage events or duplicate-prevention receipt.
- Logs, backups, and purchase records: removing live data may not immediately remove existing restricted recovery backups or service-provider records. Purchase records may also be retained by Apple and RevenueCat under their policies and applicable requirements.
6. Your controls and requests
You can read and delete messages, change your username, report messages, block senders where a usable address is available, and disable notifications. Blocking uses available network information and may not stop a sender who changes networks.
For account or broader server-side deletion, access, correction, or other privacy requests, email prizm_kr@hotmail.com. Include your public username and explain the request. We may need to verify control of the account; do not send session tokens, passwords, or payment-card details. Depending on your location, you may also have rights to restrict or object to processing or receive a copy of your data.
Anonymous sessions are not linked to a recovery email or password. Losing the original session can make messages inaccessible and ownership harder to verify. Restoring a purchase does not restore an anonymous messaging account.
7. Security and children
The app and message webpage connect to Supabase over HTTPS. We use account-level database access controls and restricted server processing. No service can promise absolute security or uninterrupted availability.
Spill is not intended for children under 13. We do not knowingly collect information from children under 13. Contact us if you believe a child has provided information so we can investigate and take appropriate action.
8. Changes and contact
We publish updates at this address and change the date above. Where required, we will provide additional notice or obtain consent for material changes.
Email: prizm_kr@hotmail.com